[3945] in Kerberos-V5-bugs
Re: [krbdev.mit.edu #1352] Cannot return prot_ready without unwrap
daemon@ATHENA.MIT.EDU (Wyllys Ingersoll)
Fri Feb 21 08:51:10 2003
Message-ID: <3E562EBE.3010707@sun.com>
Date: Fri, 21 Feb 2003 08:50:54 -0500
From: Wyllys Ingersoll <wyllys.ingersoll@sun.com>
MIME-Version: 1.0
To: rt-comment@krbdev.mit.edu
In-Reply-To: <rt-1352-4605.14.1910658821412@krbdev.mit.edu>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
cc: krb5-prs@mit.edu
Errors-To: krb5-bugs-bounces@mit.edu
Sam Hartman via RT wrote:
> Hi. I actually think our implementation is wrong to set the
> prot_ready flag before context establishment is complete. If it sets
> that flag then both gss_wrap and gss_unwrap need to work. However
> gss_unwrap cannot work because the sequence state is not yet
> initialized.
>
>
> I'm also not sure that RFC 1964 allows this behavior; I don't think
> having inconsistent support for prot_ready between implementations is
> a good idea.
>
>
> Why do you need this for SPNEGO? You don't have to generate the
> meclistmic until after the underlying mechanism has returned complete.
>
When using mutual authentication, at the time the initial token is generated,
the status is still "CONTINUE_NEEDED" and the context->established flag
is not set even though the PROT_READY flag is set and the
subkey is available. We think (Nico and I) that gss_get_mic should
be able to succeed in this case. I had not considered the "unseal" case since
that was not a problem. The acceptor side context is already "established" when
the MIC is verified, so it wasnt a problem.
-Wyllys
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
http://mailman.mit.edu/mailman/listinfo/krb5-bugs
